How to exlude some networks from VPN tunnel

In some case it’s necessary to exclude a networks (or single IP address) in VPN tunnel. It’s possible using the crypt.def file, placed on the Security Management Server.

On the Security Management Server there is no only one crypt.def file, but there is one for each version of firewall we need to make the change. To know the details please refer to the sk 98241.

First of all create a backup file with the following command (in expert mode)

[Expert@HostName]# cd $FWDIR/lib

[Expert@HostName]# cp $FWDIR/lib/crypt.def  $FWDIR/lib/crypt.def_BKP 

Then open the current “crypt.def” file

[Expert@HostName]# vi crypt.def 

At the end of file you find this string :

#ifndef NON_VPN_TRAFFIC_RULES
#define NON_VPN_TRAFFIC_RULES 0
#endif

We have to modify this row:

#define NON_VPN_TRAFFIC_RULES 0

If you want to exclude only IPv4 address, at the end of editing the file should look like this:

#ifndef IPV6_FLAVOR

#define NON_VPN_TRAFFIC_RULES (src=IP_Address_Of_VPN_Peer)

#else

#define NON_VPN_TRAFFIC_RULES 0

#endif

If you want to exclude multiple IPv4 addresses

#ifndef IPV6_FLAVOR

#define NON_VPN_TRAFFIC_RULES (src=IP1_Address_Of_VPN_Peer or src=IP2_Address_Of_VPN_Peer)

#else

#define NON_VPN_TRAFFIC_RULES 0

#endif

All the changes made in this file are transferred to the managed Security Gateway / Cluster during policy installation.